This vulnerability (CWE-306) in Windmill Labs Windmill affects versions through 1.783.0 and involves missing authorization checks on critical job_metrics handlers. Authenticated operators can bypass workspace-level access controls to read and write job progress and metrics for any job, not limited to those they own. The lack of an authorization extractor in the job_metrics handlers is the root cause, allowing unauthorized access to sensitive job execution data and the ability to inject false progress updates.

An authenticated operator can access and manipulate job progress and metrics for any job in the workspace, potentially exposing sensitive execution data and misleading other users or systems relying on accurate job status. The impact is limited to confidentiality and integrity of job metrics and progress data, with no direct availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict operator privileges to trusted users only and monitor for suspicious activity related to job progress and metrics manipulation.